Re: if this is RC4

One possibility is that the author may have simply decompiled the original code...

This might explain the char % 255's in the code. Normally such a construct is dangerous if the machine/compiler you use uses 2 byte "chars" and there's the slightest posibility of having your "char" hold more than 255. I would normally use char & 255, however it may surprise some of us that some machines can do a MOD faster than an AND and the compiler used might have exploited that feature. However, reconstructing C code out of binaries is a pain and I doubt that you'd see a header file as well as a main .c file... Anyone have experience with decompilers?